Executive brief
Erlang/OTP's inets httpd web server has a vulnerability in its mod_auth directory protection that allows unauthenticated remote attackers to read protected files. An attacker can bypass authentication by adding an extra forward slash to the request path, allowing them to access files that should be restricted by directory-level access controls. This directly compromises the confidentiality of protected content and any authentication-gated business logic.
Technical details
The vulnerability is a path equivalence bypass in the httpd request handling chain. The httpd_request:validate_uri/1 function normalizes request URIs using uri_string:normalize/1, which removes RFC 3986 dot-segments but does not collapse consecutive path separators (doubled slashes). The mod_auth:secret_path/3 function uses an unanchored regex to check if a path lies within a protected directory block; the doubled slash breaks the contiguous substring match, causing the path to be treated as unprotected. However, mod_get and the underlying operating system normalize the path correctly and serve the protected file. Additionally, the path mismatch evades per-path security accounting in mod_security. Only servers explicitly configured with mod_auth directory blocks are affected. Patches are available in OTP 27.3.4.17, 28.5.0.6, and 29.0.6 (corresponding to inets 9.3.2.7, 9.6.2.3, and 9.7.2).
Affected products
- Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
- Erlang inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Patches released in OTP 27.3.4.17, 28.5.0.6, and 29.0.6